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          "Technically, I didn't commit a crime. All I did was
          destroy data. I didn't steal anything."1
          
          
          "A floating world of liquid media where the body is
          daily downloaded into the floating world of the net,
          where data is the real, and where high technology can
          finally fulfill its destiny of an out-of-body
          experience. . In recombinant culture, the
          electronically mediated body comes alive as our
          android other. ."2
          
          
          "Reality has left the physical world and moved into
          the virtual one."3
          
          
          
I     Introduction


The signal shift in the development of the digital culture is the
loss of physical laws as the conclusive arbiter of action.

Physical and natural laws have generally governed what was
possible, and so provided limits to everything from politics to
property. Hence the notion of a "reality check. " This grounding
in physical reality provided a certain minimum commonality among
human experiences, providing the basis for shared assumptions. As
an intractable limit, the test of physical reality sorted out the
real from the dream, valid from the invalid, true from the false,
the effective from the futile, and even the good from the bad.

Correspondingly, the legal system has always been a system of
ascertainable limits, with physical "property" as it is central
core and metaphor. When intangible things of value became
valuable, the system bred "intellectual property" to cover these
intangibles. The legal system rapidly extended its reach to all
manner of vap'rous, indiscernible stuffs: we own, and


  1Martin Sprouse (ed.), Sabotage in The American Workplace:
Anecdotes of Dissatisfaction, Mischief and Revenge (1 992)(Bank
of America employee planted a logic bomb in the computer system).
  
  2Arthur Kroker, Spasm 36 (New York, 1993).
  
  3Benjamin Woolley, Virtual Worlds 235 (Cambridge, 1992).
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can steal, and can sue over: invisible trade secrets, accounts
receivable, expectations of profit, and patented ideas. By and
large these intangibles, and all the intangible personal rights
protected by constitutions and law, all plainly do find tangible
expression or location. The patent is written out on paper, the
right of privacy inheres in our physical selves. The intangible
stuff is actually parcelled out on a per capita basis, and
documents are kept which certify the individual owners and in so
doing mark out the boundaries, the borders, among these
incorporeal things. That's why we can reasonably call the stuff
"intellectual property."

But we are leaving the physical world behind, and with it the
touchstone of physical and natural laws, together with the notion
of irreducible limits. Increasingly, the things we deal with are
located in a digitized networked space.4 This is marked by the
remarkable increase in computing power available to the average
user5 and growth of the networks.6 The social work of the culture
increasingly is mediated by the computer. Too, the productivity
of the culture -- the making of valuable things -- is done on
computers, and those valuable things are often bit-composites
stored on those machines.

The stuff in computers is information. Some people want to use
information in ways that horrifies others. Disputants call on the
legal system to settle the matter, and some people get indicted.
The law has to provide answers, but there is no consensus on what
the rules are: the technology is growing too fast, and there is
too much myth and ignorance. Instead of social consensus, the
federal and state governments have passed laws, hundreds of them,


  4S. Zuboff, In The Age Of The Smart Machine (New York, 1988);
Benjamin Woolley, Virtual Worlds 133-134 (Cambridge, 1992).
  
  5We see about 50-70% more computing power per year, and memory
density doubles every 12-18 months. Since 1978, desktop
transistor density has gone up 100 times, and raw computing power
over 500 times:
  
     80x86 Performance- Max MIPS   Transistor
                                   density

June '78       .75                      29,000
1982           2.66                     134,000
April '89      70                       1,200,000
March '93     112                    3,100,000
March '94     166                    3,300,000

"80x86 Evolution" 19 Byte 88 (June 1994).

  6Note the size and growth of the internet: 21,000 connected
networks, 60 countries, 15 million users; 2 million computers,
with a rate of monthly growth of 7 to 10%. See also "Special
Report: Distributed Computing," 19 Byte 125 (June 1994).
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criminalizing so-called "unauthorized access" and data
transmission. Other groups, too have called for laws,
regulations, bills of rights, cyberspace constitutions, and so
on, to regulate the electronic arena.

These efforts are futile.


II   Understanding Information


There is a deep confusion on the value of data and information.

Those who value it most treat it with no honor. They may take a
perverse pride in its mutation, in its endless potential, in its
infinite mutability. The apostles of the information age tell us
that data is free,7 that the wineskins have burst,8 that
information belongs to us all. Of course, information that is as
ubiquitous as air, cheap as sand, is barely property at all.
These same people believe profoundly in the value of privacy, and
are the vanguard of those combating the Government's efforts to
control the keys to private encryption. They. oppose the Clipper
chip, U.S. government monopolies on encryption devices, corporate
control over personal and credit information, and other threats
to the individual's power to exercise total domain over the data
that he creates. They see -- correctly, I think -- that control
over and access to information, on the one hand, and control over
the citizenry, on the other hand, are actually inseparable.

On the other side, those charged with the enforcement of the law
know well that our movement to an information society is
transforming notions of property. They think that if digital
property cannot be protected, then property as such will be
eviscerated, and with it one of the central foundations of the
legal system. It's true; tampering with data can cost millions of
dollars; some information is private and shouldn't be released;
some data storage areas, and entire systems, should be off limits
to unauthorized personnel. The digital world, despite its
increasing size and universality - or indeed as a result- does
not stop at the keyboard and electron tube: it reaches out into
the physical world and operates subway systems, nuclear power
plants, passenger aircraft and the economies of the developed
countries. Precisely because much of what we call physical
reality is controlled by computers, we care very much about what
happens to specific data. Criminal law must handle the real world
consequences of these electronic events.

But most judges, juries and prosecutors don't understand the
technology. It's difficult to spend time and money on
investigations of system break-ins, it's hard to ask for jail
time when the only harm was a temporary slow-down of a network,
and it's troublesome to try a



  7Lauren Wiener, Digital Woes (1993).
  
  8John Perry Barlow, "The Economy of Ideas," 2.03 Wired 84
(March 1994).
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case when the perpetrator simply looked around a few files, and
left a little electronic graffiti. Why lock someone up for
peaking over the digital fence? Who's been hurt? What's the loss
in value of picked-over data? When the criminal justice system is
wholly overwhelmed by traditional crimes of violence, murder,
drugs and the rest then electronic crime takes a back seat. It is
too difficult to understand and too complicated to spend time
on.9

There is a deep ambivalence over the value of information.


III  Parceling out Information as Property

The law and the culture it symbolizes may not comprehend the
nature of data and information, but the law does know what
property is. For this reason recent developments in computer
law10 consist by and large, of (i) developing the definition of
"property" in the digitized world,11 and (ii) the adumbration of
proscribed actions done with that newly broadened definition.
Laws address the interception of data, accessing data and
systems, tampering with and altering data, obtaining data of
value, frustrating authorized users from accessing data, and
viewing other's use of data, including keystroke monitoring.12


  9Michael Gemignani, "Viruses And Criminal Law," reprinted in
Lance Hoffman (ed.), Rogue Programs: Viruses, Worms and Trojan
Horses 99 (New York 1990).
  
  10Every state but Vermont has some form of computer-specific
criminal statute. Note, "Computer-Related Crimes," 30 American
Criminal Law Review 495, 513n.144 (1993). See generally, Anne
Branscombe, "Rogue Computer Programs And Computer Rogues," Rogue
Programs at 59.
  
  11For example, Massachusetts found it necessary to pass a law
stating that "property" includes "electronically processed or
stored data, either tangible or intangible, [and] data while in
transit..." Mass. Gen. Law Ch. 266,  30(2)(1992). In its efforts
to combat computer crime, Missouri [like many other states] now
defines property to include "information," any electronic data,
and indeed any intangible item of value. Missouri Stats.
569.093 (10). Kansas defines property similarly for the same
purpose. Kan. Crim. Code  21-3755 (i)(h). California makes it a
crime to, without permission, use or copy computer data, or to
access that data, or to prevent others from accessing it. Cal.
Penal Code  502(c)(2), (4), (5) and (7). New York' s law,
typically, also focuses on unauthorized access to and tampering
of computer data. N.Y. Penal Law  156.10; 156.20.
  
  1218 U.S.C.  2510; [Federal] Computer Fraud And Abuse Act.
"Currently 26 million employees are monitored at work, and this
number should increase as computers become more widely used and
the cost of monitoring systems deceases. If employers monitor the
number of keystrokes we make a minute to assess our productivity,
or read our electronic mail, what will they be allowed to do in
the future as the human-machine interface becomes even more
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Computer crime laws first appropriate the entire digital world,
claiming the right to control the movement of every electron and
fiber cable photon; then these laws carve out the boundaries of
criminal behavior through the notion of "unauthorized access."
Beautiful borders circumscribe each grouping of data; criminal
behavior is the breach of the border.

The coverage of these laws can be stunningly broad: every
computer and every attached devise and all communication
facilities "related to or operating in conjunction with" the
system can be protected under federal law (18 USC  1030(e)), and
in Pennsylvania it can be a crime to interrupt the "normal
functioning" of a system or organization, whatever that means.13

For example, federal law focusses directly on the unauthorized
access of a computing system, and refines that by also making it
a crime to exceed one's authorized access to secure, for example,
financial information. 18 USC  1030. A ten year jail term can be
imposed for preventing others from their authorized use of a
system. 18 USC  1030(a)(5). It is a federal felony to have an
unauthorized access to a system for the purpose of any copying or
taking or disclosing or possession of anything of value. Id. Any
access which exceeds one's authority and which thusly secures or
alters any information, or which prevents an authorized user from
having access, is a federal crime. 18 USC  2701.

Thus computer crime laws follow the general legal presumptions of
discrete, separable areas surrounding and defining each legally
cognizable entity: homes and property around individuals
protected by trespass laws; a web of trade secrets and
confidentiality around corporations; and privacy interests
marking them all off from each other. These are the traditional
rules of consanguity, and the digital universe has been subject
to the same colonization. Every user's access is protected from
everyone else's. Every digital interference, from destroying
another's data to degrading the computer system,14 can be a
crime.

Law defines the borders, and so the very existence and shape, of
legal entities. When the breaches are mild, use the civil law and
sue; when the breaches are considered severe, enter the criminal
law.




  12(. . continued)
  
personal?" Clifford Pickover, Introduction, Visions of the
Future: Art, Technology, and Computing in the 21st Centurv (2d
ed.).

  13Pa. Cons. Stats. tit. 18  3933.
  
  14De1. Code Ann. tit. 11  934. Many states proscribe denying
or interrupting computer services to authorized users. E.g. Pa.
Cons. Stat. tit. 18  3933 (a)(1); Cal. Penal Code  502 (c)(5).
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IV   Faultv Transition to The New Network

          Run, run, run as fast as you can You can 't catch me -
          I'm the Gingerbread Man.
          
These efforts, are, like much of the law's attempts to play catch
up with technology, too little, and too late. The legal system,
inherently conservative, is perpetually a decade behind the
technology15 and so the governing law can rarely be directly
invoked. As I note below, though, the price for this divergence
is paid by technology as it finds itself shackled by unfit law.

There are two central reasons for the law's difficulty in
treating electronic material as property. First, data is
infinitely mutable and so untraceable; second is the nature of
the network.

     1.Infinitely Mutable Data
     
The character of this chaos is set by the technology's apparent
disregard for the laws of physics, its chameleon skin and
infinite capability for morphing. The outstanding fact of data,
and of the algorithms that operate on them, is the property of
recombinancy. Originals are in no way distinguishable from
copies; the very notion of an "original" is empty. The same data
can be manifested as sound, text and image, and thus each as an
algorithmic equivalence that defeats conventional notions of
copying and reference. Every transformation is of an equivalent
validity. Transmogrification is now banal. Continuity, accuracy,
and truth are a function, thus, of the algorithm; these becomes a
purely mathematical concept. The integrity of the data substrate
is wholly divorced from the infinite colors and shapes and forms
of its manifestations and appearance.

You -- You cannot tell where the data came from, what the data
is, who made it, when it was made, or if it mutated, or was
stripped of identifying information such as trademark or




  15An appellate opinion read today took four years to get
through the trial system, and about another year and a half in
the court of appeal. Of course, the technology had been out on
the consumer market before the case was initially filed, and so
was a few years old then. The court of appeal decided the meaning
and effect of a statute that dated back to the filing of the
case, some six or seven years ago, and which had actually been
passed a year or so before that, in response to the technology of
the day. Now one knows what a nine year old statute means. (The
statute has since been amended.) Examples of problems caused by
technology outstripping the law are discussed in Curtis Karnow,
"The Uneasy Treaty Of Technology & Law," Al Special Issue,
Virtual Reality (Premier Issue, 1994).
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copyright claims. Only the computer knows, and its memory is
volatile. It has permanent amnesia.

     2.   Digital Networks
     
The truth is that we do not use separable computers, that we no
longer access separable information and data. We do not really
have discrete data in separate banks of RAM, or a discrete CPU in
every garage. The slow, painful efforts of the legal system to
accommodate the computer are mooted by the advent of the network.

Law-makers see communications devices and other connections
simply as appendages to the key individual computer and data
vaults. The image is of a network as simply the medium by which
the data travels and by which criminals access property.  The
image here is of streets connecting homes, the medium of air
between communicating humans, empty space between the stars.

But that image is false.

For the network reveals that there are no borders, and never will
be. The ultimate networked machine is wholly wired, operating
across time and space at the speed of light, connecting every
user to every database. This is a sort of single parallel
processing multi-threaded machine, and it isn't far from reality.
The fact of interconnectedness is as critical to the nature of
the computing as the connected nodes themselves. Just as
electricity itself has no meaning absent the conducting wires, so
too the evolving computing environment is essentially a connected
unitary whole.16

This essential fusion produces a deep quandary for the new
computer crime codes. There are problems with the obscenity law
of Tennessee affecting BBS operators in Arkansas and California;
there are problems with the US trying to restrict the so-called
"export" of encryption software across the physical U.S. borders
while billion transfers of the same software across the 50 states
are legal. There are issues with applying classic telephone
wiretap law to the interception of email within a company. It is
not clear if an "unauthorized access" has occurred when an
authorized user inadvertently introduces into a system a viruses
written by someone without access. It is not possible to
determine if a repair techmcian with approved "supervisor" access
to a network can legally look at data. We don't really know if
privacy rights protect files on local hard drives and whether
different rules apply to hard drives across the state or national
borders. We know the U.S. government can't insist on the



  16"[C]yberspace.. [is] the place where our lives and fates are
increasingly determined... .
  
The power of this realm comes from its connectedness. It is a
continuum, not a series of discreet systems that act
independently of each other. Blips are not isolated events."
Benjamin Woolley, Virtual Worlds 133 (Cambridge, 1992).
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right to record keystrokes at my stand-alone PC, but the FBI
wants the power to record and read keystrokes if sent by wire.17

This is utter confusion. There are different laws with different
results regulating a single activity. Federal and state law
conflict on privacy rights and criminal conduct; we have
conflicts between the laws of two or more states, all of which
simultaneously apply to the same networked environment.

To catch up with technology, states have extended the definition
of "property" to electronic impulses:18 but in the electroverse
of infinitely mutable replicant data, that net sweeps far too
wide. Under this brave new regime, theft can include logging onto
the wrong partition, a felony erupts when an unwanted comment
appears on a start-up screen, 9 and you could get jail time for
playing the networkable multiplayer games DOOM or Falcon on your
employer's network.20 Think of it this way: DOOM is a sort of
Trojan horse, a virus pretending to be a game.

Indeed, there are a host of unexpected behaviors we've seen
explode from the products of. commercial vendors that could
qualify as felonies under the new laws. For example: so-called
"compression" software that slows down a system, operating
systems that trash files, telecommunication devices that loose
mail, or any iota thereof. As some of you know, there's a bug --I
mean a feature --in the Windows tool OLE 2.0 which allows one to
send a hidden





  17Which is why fibre optic cable and its bland transmission of
a thousand pulses of light makes some people in the government
ill. [Optical fibre is not what George Bush meant when he
referred to a thousand points of light.]
  
  18See, i.e., Montana Code  4-5-2-310 (covering any input to
or any output from any computer or network).
  
  19Conn. Gen. Stat.  53a-25 1 (e); Del. Code Ann. tit. 11
935. See also, Branscombe "Rogue Computer Programs" supra at 68.
  
  20Prosecutors have almost unlimited discretion to indict
anyone they want. They will go ahead and do just that when the
statute says that theft of property is a crime, and then defines
property as electronic cycles; or if the law criminalizes any
unauthorized use of system; or makes it a crime to "degrade" a
system: that's exactly what DOOM will do. The program uses
broadcast messages, up to 100 per second, across the network,
which degrades the system and can even crash it. See "Games Storm
LANs," 5 Infosecurity News 8 (July/August 1994). Multi user
dungeons (MUDs), too, have been banned from universities and
entire continents (Australia) because of their degrading impact
on systems resources. Kevin Kelly et al., "The Dragon Ate My
Homework," 1.3 Wired 69, 73 (July/August 1993).
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program inside a document, defeating many routine security
techniques.21 Sounds like unauthorized access to me.

But criminal unauthorized access? Crooks, surely, must "intend"
to do evil before they are locked away. A noted programmer
describes how to make a simple modification to a C compiler which
will be undetectable and cause a miscompilation under set
circumstances. "If this were not deliberate, it would be called a
compiler 'bug.' Since it is deliberate, it should be called a
Trojan horse."22 But the "deliberate-mistake" dichotomy is not
quite how the criminal law operates. "Reckless disregard" of the
consequences, knowing enough so that one ought to know the
consequences, is usually enough for a conviction. As one my
favorite jury instructions notes, we are all presumed to know and
intend the ordinary consequences of our actions-- and that can be
a lot of consequences. Presumably someone at Microsoft knew of
the OLE bug; presumably Borland knew when it released C++ 4.0
that it generated a rounding error. 23 Both these bugs, of
course, in effect destroy data; arguably, Microsoft and Borland
"intended" that destruction. And the "deliberate-mistake"
dichotomy does not correlate with the risk posed by viruses,
either: some like the Macintosh Scores virus (and perhaps, too,
the famous internet worm) probably was released unintentionally
into the general population24. In both cases, though, many
prosecutors would indict and secure a conviction under the new
computer crime statutes.

Is that too bizarre? A prosecution for a bug that eats data or
that provides an entry point for data modification? Not bizarre
at all. Decisions to indict are essentially unreviewable, and
often made by prosecutors with a weak grip on the technology. And
the same the same can be said for the juries that decide on
guilt.





  21The problem is one that could affect distributed objects
generally. In the case of OLE 2.0, the embedded item appears to
be data; but when activated (for an edit, for example) causes the
current program to yield control, including its menu bar, to the
parent program that created the data; that parent program could
be anywhere on a network, an unknown quantity to the present
user. See i.e., Peter Coffee, "Distributed objects form info
highway hazards," PC Week 80 (April 18, 1994). As a related
concern, it is practically impossible to keep track of the
copyright issues governing objects shared among applications, or
swapped in from remote sites. See William Brandel, "Objects Spur
User's Licensing Concerns," 28 Computerworld 1 (July 4, 1994).
  
  22 Ken Thompson, "Reflections on Trusting Trust," Rogue
Programs at 121, 125.
  
  23 Peter Coffee, "Close enough isn't good enough in computer
math," PC Week (February 14, 1994).
  
  24 Suzanne Stefanac, "Mad Macs," Rogue Programs, supra at 180,
189.
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V    Interlude: State of The Net

Let us pause to probe deeper into the nature of networked
computing. There are two central aspects that bear scrutiny.
Those aspects are: (i) agents and related objects, what I term
self-directed code, and (ii) the world-wide electronic
environment in which those agents operate: webbed databases.

Let me briefly describe these.

Self directed code means those programs that can be let loose to
find their way and report back with some sort of result. These
exists in rudimentary form now, in everything from Borland's and
Microsoft's spreadsheets to General Magic's draft
telecommunication programs. These "agent" objects combine code
and data, are independent, sensitive to their context, and
therefore do not need complete instructions from the human
operator: in that sense, these agents are self directing: they
don't need direct human supervision. The point is to embody some
amount of artificial intelligence and thus be able to execute
some unpredicted computer tasks.25

The second salient aspect here is the development of worldwide
hyperlinked databases, utterly transparent to the user.26
Already, users of the internet' s worldwide web are familiar with
the invisible shifting of data sources. True global networking is
the ultimate, realizable, ambition.27 Every network now accepts
and operates with the notion of a logical drive, as opposed to
the physical drive resident in determined physical space. The
simple notion of logical drive, logical space as oppose to
physical space, makes it plain that a network "exists" everywhere
that any user can access. Noting the physical location of our
data is utterly pointless.28


  25See generally, special issue, "Intelligent Agents," 37
Communications of the ACM (July 1994).
  
  26Today, nearly three-quarters of Fortune 100 companies spread
their data across multiple databases. The number is expected to
rise from today 72% to 86% by 1996. "Fractured Data Reported," 5
Infosecurity News 9 (July/August 1994).
  
  27For a list of products devoted to global networking, see
"The Best of Interop+Networld," Byte 36 (July 1994).
  
  28Operating systems now all incorporate this sort of
transparency: that's part and parcel of the "networkable"
approach to such systems. For a peek just a little way into the
future, see Steve Polilli, et al., "IBM will launch revamped E-
mail strategy in fall," 16 InfoWorld 1, 75 (July 4,
1994)(Distributed Computing Environment due in 1995, including
virtual directory trees for enterprise-wide net, email with
agents). Microsoft's Chicago (Windows 4.0)
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Imagine, now: self-directing code in a worldwide habitat of
hyperlinked data.29 That is our model network.

This electroverse is a concatenation of endlessly looping data
and symbols that do nothing ultimately but refer to themselves
and to combinations of themselves. Here, the physical and natural
worlds are leveled, electrocuted, no more than a series of signs
and symbols.

This is the nebulotic data soup. It is an unrestrained, frenzied
hyperbole of text, sound and graphics, each moment a cut and
paste morphed version of others, an endless processing and
transmission of the bitstream. Memory is a looping self-
replicating tape: there is no past, or an infinity of pasts.

Here we have the infinite geography of the electronic cosmos
operating at lightspeed: communication so fast and transparent
that the elements, the actors, the agents of communication are
swept up into the transmission stream and loose all identity but
for their existence as transmission agents, each a repeating
station, each no more than input and output; each one a copper
wire linked into other wires, until we have a single endlessly
looping strand, truly e pluribus unum. The electroverse is zero
culture, inhabited by android shadow-selves who fear no law,
abide no punishment, and feel no guilt.

It is in this digital soup, this is a hyper-relational
environment, that we see the death of the barrier. We have no
cells, we have no inside and outside, we have no public world and
we have no private world. What we do have is the network and the
death of dichotomy. This is fatal for the legal system, which
depends for its very life on the existence of barriers- after
all, that's what the law does: it utters the line between this
and that, and punishes the transgressor.




  28(. . .continued)
  
operating system -- which unlike Windows 3.1, is a true operating
system including a replacement for DOS -- introduces
"applications built around networks and a built-in capacity to
share information. E-mail, for example will be accessible from
the too! bar." David Coursey, "The Death of The Single User," PC
World 53 (June 1994). Finally, for an example of a patent
describing data displays independent of the physical hardware,
see "Multiple Virtual Screens on an 'X-Window' Terminal," U.S.
Patent No. 5,289,574 (issued February 23, 1994 [Hewlett Packard,
assignee]).

  29"The seamless nature of object systems will radically alter
the way we think about where our data is. Data will be
encapsulated in objects that will in some cases be able to roam
to where they are most needed. We are in the habit of thinking
that a document is simply stored on a particular hard disk.
Distributed object systems will ask us to surrender that
comfortable certainty in exchange for the power and flexibility
of location-transparent storage." Peter Wayner, "Objects on the
March," BYTE 139 (January 1994).
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But our android shadows cannot be punished.


VI   Crime In A Phantasmagorical Terrain

          There are probably no secure systems on the In tenet.
          30
          
What does this pose, this universe of warpspeed propagation of
data and signs, this self-metastasis, this cancer of replicating
code out of control? The problem is one of extreme difficulty and
consequence, because while the law evaporates as the network is
perfected, the need for law grows as the network expands to
control the infrastructure of the real world.31 The essential
connectivity of the network generates at once its extraordinary
power, its volatile reactivity, and so its striking
vulnerability.

This, then, is the nub of the problem. As I have noted, the
solution to date has been to pass more and more laws, more
regulations, calls for new constitutions of cyberspace, to invoke
new rights, new privileges; to heap laws on laws. The confusions
regarding data and information that I described earlier have been
addressed in just this way by all sectors of the political
spectrum: The FBI wants more laws,32 liberal Harvard law school
professor Lawrence Tribe wants more laws,33 the National Security
Agency wants regulation of encryption, employers want rules on
employee privacy rights, online services such as GEnie and
Prodigy regulate "inappropriate" and "offensive" speech,34
Congress is considering new


  30Peter Neumann, SRI International, quoted in Peter H. Lewis,
"Hackers on internet pose security risks," The New York Times,
p.C19 (July 21, 1994).
  
  31The self-contained replicant synthesis of networked data
actually resides in the physical world; it incorporates real
human beings who live and eat and die. The truth is that the
digital world truly affects and is affected by the physical
world: it operates nuclear power plants, subways systems and
passenger aircraft. "[A] blip in the money markets can raise bank
lending rates, a blip in a multinational's productivity can close
factories and throw economies into depression, a blip in the TV
ratings can wipe out an entire genre of programming, a blip in an
early warning system can release a missile." Benjamin Woolley,
Virtual Worlds (Cambridge, 1992) at 133.
  
  32See i.e the new Telephony bill introduced by the Government
last year which would ensure the ability to conduct court
approved wire taps, and so on.
  
  33Tribe proposed a new electronic bill of rights in his
keynote address to the first Computer, Freedom & Privacy
conference (CFP).
  
  34See i.e., Peter H. Lewis, "Censors Become A Force On
Cyberspace Frontier," The New York Times p.1. col. 1 (June 29, 1
994)(forums shut down because subject matter might be
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copyright law to make it perfectly clear that electronic copying
Ls copying.35 This is the all-American way: more legislation.
Don't let anything escape; take no prisoners.

This impetus is fueled by the cynical acceptance by the
government -- the legislatures and law enforcement -- that
electronic reality really does exist as a sort of parallel
universe. They have come to buy the proposition that virtual
reality -- what I have termed tongue-in-cheek the electroverse -
- has an existence independent, legally speaking, of the day to
day reality governed by traditional law. Denizens of that place
call it cyberspace, a high frontier, a new territory precisely
like the Moon or some other undiscovered country.

The law-makers have endorsed that schizophrenia pressed by the
electro-cognoscenti, and they have endorsed it out of fear,
ignorance and misunderstanding. How else to react to the
omniscient, omnipotent power of cyberspace? Well, take its unruly
tenants at their word [they seem to know what they are talking
about], and treat cyberspace as a competing reality: regulate it,
and break it up into chunks called property.

But alternative universes provide a very bad model: Neither law
nor technology benefits. The law founders and sinks in the clear
blue fungible sea of the network. And the electronic community is
on the verge of being legislated to death, ruled out of fear and
loathing, chained by broad and detailed laws that can make
anything -- the movement of an electron-- illegal.

The notion of cyberlaw -- legal rules peculiar to the electronic
communications context --makes no more sense than printlaw,
newspaperlaw, movie law, T.V-law, shopping center law, video game
law or, indeed, washing-machine law. The network is not in fact,
a place like the Moon. It is a tool, a machine, like a tractor or
a pen or velcro, an extension of the physical, moral human being
who in turn is subject to the mundane legal system. We can have
no law of place or property here, and so new computer crime law'
s heavy regulation of data and "authorized access" is quite wrong-
headed. Computer crime is not really about "unauthorized
access,"36 the actions of self-directed code in the network are
not "intended" in any sense


  34(.. continued)
inappropriate for, i.e., young girls; messages with religious,
ethnic and other references deleted; users warned of possible
termination, etc.).

  35Congress will be asked to consider a series of amendments to
the Copyright Act which among things would state that an
electronic transmission is a "publication" of a protected work,
that copyright holders have electronic distribution rights to
their works, and so on. See "Intellectual Property Working Group
Draft Report," released July 7, 1994. Telnet iitf.doc.gov (gopher
login) /speech testimony & documents.
  
  36Ironically, and most importantly, nearly 80% of "computer
criminals" are actually insiders with verified system access."
Nina Stewart, Deputy Assistant Secretary of Defense,
Counterintelligence & Security in 4 InfoSecurity News 32
(May/June 1994). The FBI has
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recognized by the criminal law, it can be impossible to tell if
anyone "owns" any given chunk of infinitely mutable data.

The battle of the metaphor always erupts in the face of new and
powerful technologies. Our imagination is fired, but our
stability is threatened; and we always seek precedent for
understanding. So we use the property analogy; the metaphor of
invaded homes and goods when systems are attacked, the allusion
to space and universes. But this is a category mistake. Computer
mediated "space" is no more space than DNA is a person, no more
than digital signals are a picture or a novel. Bits and bytes are
not the equivalent to their manifestations; the genotype is not
the phenotype.

The criminal law has no business here. For the network has no
borders, and the autonomous space of hyperperfect illusion and
flawlessly recombinant culture is too slippery for any statute.

But, should then the wiley hacker deploy with impunity? Shall we
let a thousand viruses bloom? What is the reasonable role of the
law in view of the fact that networked computers operate our
transportation, banking, powerplants, military and other key
infrastructures?37

Control -- the control we need -- is not finally a legal problem
at all. It is a social, moral, and technological problem. The law
simply will not save us from the next full stealth polymorphic
virus; but widely accepted social norms and technological shields
might. Back up the data, use firewalls to insulate machines and
data, use smart cards and arbitrary, changing passwords; employ
private cancelbots; use real encryption for authentication and
privacy. Never make the mistake of believing that a computerized
system is necessarily an improvement; and think about not using
computers, at all, for certain very high-risk tasks.38


  36(. . .continued)
  
reported that in 80% of its computer crime investigations, the
internet was used to gain illegal access to systems. Gary Anthes,
"Internet panel finds reusable passwords a threat," ComputerWorld
28 (March 28, 1994). But unless Ms. Stewart's figures are wrong,
the FBI's estimates are more a function of the FBI's interests
than a reflection of the real world.

  37"Today, with almost every detail of modern life controlled
or influenced by computers nd communications-driven systems, our
infrastructure has an exposed underbelly: software." Peter Black,
"Soft Kill," 1.3 Wired 49-50 (July/August 1993).
  
  38A number of writers, including this author at the last
DEFCON conference, have suggested dispensing with computers for
certain tasks. Bev Littlewood et al., "The Risk of Software," 267
Scientific American 62 (November 1992); Lauren Wiener, Digital
Woes (1993); Curtis Karnow, "Legal Implications of Complex
Virtual Reality Systems," DEFCON 1 (July 1993). See generally,
RISKS usenet forum moderated by Peter Neumann, FTP CRVAX.SRI.COM
and go to the appropriate directory with "CD RISKS:". [usenet
news: comp.risks]
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When real people suffer real injury, measured as real financial
loss, then indict and convict those who really and demonstrably
intended that harm. That's the purview of the criminal code. If a
jury of ordinary people, using ordinary laws on fraud and theft,
wouldn't convict, then leave it alone. Put the armed criminals in
a cells, and leave the android shadows to their electric dreams.
There are grey areas, to be sure, but there should be grey areas,
governed slowly by developing manners and custom, not crushed out
by an omnipresent criminal code.
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